From d027395181d3e0c5796340ff87f2cddb41b93d29 Mon Sep 17 00:00:00 2001 From: Jocelyn Turcotte Date: Tue, 7 Sep 2010 17:07:38 +0200 Subject: QtWebKit: Downstream patch 2 fixing a crash on MSVC 64bit. http://bugreports.qt.nokia.com/browse/QTBUG-13279 Sha1 on qtwebkit.git: 460b651cbe4f6994b492ff08614e57b0e31a24c8 Reviewed-by: Simon Hausmann --- src/3rdparty/webkit/JavaScriptCore/ChangeLog | 12 ++++++++++++ .../webkit/JavaScriptCore/interpreter/Interpreter.cpp | 2 +- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/src/3rdparty/webkit/JavaScriptCore/ChangeLog b/src/3rdparty/webkit/JavaScriptCore/ChangeLog index c09ad79..2be6f5a 100644 --- a/src/3rdparty/webkit/JavaScriptCore/ChangeLog +++ b/src/3rdparty/webkit/JavaScriptCore/ChangeLog @@ -1,3 +1,15 @@ +2010-07-08 Andreas Kling + + Reviewed by Oliver Hunt. + + Interpreter: Crash in op_load_varargs on 64-bit + https://bugs.webkit.org/show_bug.cgi?id=41795 + + Added missing cast of argCount to int32_t in op_load_varargs. + + * interpreter/Interpreter.cpp: + (JSC::Interpreter::privateExecute): + 2010-07-02 Peter Varga Reviewed by Oliver Hunt. diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp index 9e2e788..a56040c 100644 --- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp +++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp @@ -3475,7 +3475,7 @@ skip_id_custom_self: argStore[i] = callFrame->registers()[i - RegisterFile::CallFrameHeaderSize - expectedParams]; // Then we copy any additional arguments that may be further up the stack ('-1' to account for 'this') for (; i < static_cast(argCount); i++) - argStore[i] = callFrame->registers()[i - RegisterFile::CallFrameHeaderSize - expectedParams - argCount - 1]; + argStore[i] = callFrame->registers()[i - RegisterFile::CallFrameHeaderSize - expectedParams - static_cast(argCount) - 1]; } else if (!arguments.isUndefinedOrNull()) { if (!arguments.isObject()) { exceptionValue = createInvalidParamError(callFrame, "Function.prototype.apply", arguments, vPC - callFrame->codeBlock()->instructions().begin(), callFrame->codeBlock()); -- cgit v0.12